CVE-2015-5178

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-254

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-51797.5FreeIPA might display user data improperly via vectors involving non-printable characters.CVE-2015-51807.5res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash CVE-2015-51815.4The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.CVE-2015-51828.8Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.CVE-2015-51837.5Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.CVE-2015-51847.5Console: CORS headers set to allow all in Red Hat AMQ.CVE-2015-51855.0The lookupProviders function in providerMgr.c in sblim-sfcb 1.3.4 and 1.3.18 allows remote attackers to cause a denial of service (NULL poin CVE-2015-51865.3Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.CVE-2015-51876.5Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffi CVE-2015-51886.8Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and CVE-2015-51894.9Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to g CVE-2015-51908.5The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.